CVE-2026-116631 Details
Description
A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.
A spoofing vulnerability has been identified in Mozilla Firefox for iOS, specifically in version 156.0 prior to 156.1. A malicious web page could exploit this vulnerability by opening a tel link in a window displaying a different website. This would cause the phone-call prompt to appear as if it was requested by the site being displayed, potentially leading to confusion or misuse.
Users can update to Firefox for iOS version 156.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1297353 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://www.mozilla.org/security/advisories/mfsa2026-117/ | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-451 | User Interface (UI) Misrepresentation of Critical Information | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Mozilla Firefox | >= 156, < 156.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | New CVE Received | [email protected] |
| Oct 26, 2026 | CVE Modified | CISA-ADP |